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Abstract. — We give an overview of the theory of Heegner points for elliptic curves, 
and then describe various new ideas that can be used in the computation of ratio- 
nal points on rank 1 elliptic curves. In particular, we discuss the idea of Cremona 
(following Silverman) regarding recovery a rational point via knowledge of its height, 
the idea of Delaunay regarding the use of Atkin-Lehner involutions in the selection of 
auxiliary parameters, and the idea of Elkies regarding descent and lattice reduction 
that can result in a large reduction in the needed amount of real-number precision 
used in the computation. 



1. Introduction 

We make some remarks concerning Heegner point computations. One of our goals 
shall be to give an algorithm (perhaps conditional on various conjectures) to find a 
non-torsion rational point on a given rank 1 elliptic curve. Much of this is taken 
from a section in Henri Cohen's latest book [S], and owes a great debt to Christophe 
Delaunay. The ideas in the section about lattice reduction are largely due to Noam 
Elkies. We do not delve deeply into the theory of Heegner points, but simply give 
references where appropriate; the recent MSRI book "Heegner points and Rankin 
L-series" contains many good articles which consider Heegner points and their 
generalisations from the standpoint of representation theory. 

The author thanks the Institut Henri Poincare for its hospitality and the Centre 
National de la Recherche Scientifique for financial support. The algorithms described 
here have been implemented in the Magma computer algebra system |4]; the author 
thanks the Magma computer algebra group at the University of Sydney for their 
hospitality and financial support. The author was also partially funded by an NSF 
VIGRE Postdoctoral Fellowship during part of this work. 
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2. Definitions and Outline of Theory 

Let t be a quadratic surd in the upper-half-planc H. Let f T = (A, B, C) be 
the associated integral primitive positive-definite binary quadratic form, so that 
At 2 + Bt + C = with A > and gcd(A,B,C) = 1. The discriminant A(t) is 
A(/ T ) = B 2 — AAC, which is negative. For simplicity we take A(r) to be funda- 
mental, though much of the theory can be made to work when it is not. However, 
consideration of positive discriminant does not follow in the same manner. 

Definition 2.1. — A Heegner point of level N and discriminant I? is a quadratic 
surd in the uppcr-half-plane with A(t) = D = A(Nt). We let be the set of 
Heegner points of level N and discriminant D. 

Proposition 2.2. — Let t e H be a quadratic surd with discriminant D and f T = 
(A,B,C). ThenreHft iff N\A and gcd(A/N, B, CN) = 1. 

Proof. Note that t = and Nt = =MB±nVd \ For A(r) = A(Nt) we 

need Nt = B 2 a' anc ^ by equating imaginary and real parts we get A = NA' 
and B = B', so that N\A. Also note that (A/N){Nt) 2 + B(Nt) + (CN) = 0, from 
which we get the rest of the lemma. □ 

Note that Tt® will be empty unless D = B 2 - AN(A/N)C is a square modulo 47V. 

Lemma 2.3. — The set Ti.® is closed under To(N) -action. 

Proof. — If 7 G SL 2 (Z) D T (N) then A( 7 (r)) = A(t) since the discriminant is 
fixed. A computation shows that 7 e r (A^) and r e imply -f(r) e H^. □ 

Lemma 2-4- — The set Tt® is closed under the W^-action that sends r — > —1/Nt. 

Proof. — Follows from the above proposition since /(_i/jv t ) = (CN,—B,A/N). □ 

Definition 2.5. — We let SS(D,N) be the set of square roots mod 2N of D 
mod 4N. 

Theorem 2.6. — The sets H%/T {N) and SS(D,N)xCI(Q(VD)) are in bijection. 

Proof. — This can be shown by chasing definitions. Essentially, [r] <G H.®/r (N) gets 
mapped to (B mod 27V) x [Z + rZ] where f T = (A, B, C), and in the other direction, 
when we are given /? x I e A) x C/(Q(v / I?)) we take (A, B,C) e I with N\A 

&ndB = (3 (mod 2A), and then r = ~ B 2 Y^ . □ 

From now on we let E be a global minimal model of a rational elliptic curve of 
conductor N, and take D to be a negative fundamental discriminant such that D is 
a square mod 4A. We let H* be the union of H with the rationals and ioo. We let 
V(z) be the function that sends z e C/A to the point (p(z), p'{z)) on E. 

Theorem 2.1. — There is a surjective map <f> : X (N) — > E (the modular parametri- 
sation) where X (N) — H*/r (A) and E can be viewed as C/A for some lattice A. 
This map can be defined over the rationals. 
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Proof. — This is due to Wiles and others gHl EU EH 113 EU We let be the 

associated map from H*/To(iV) to C/A. Explicitly, we have that r G H* gets mapped 
to the complex point <j){r) = 2ni j. ipE = Tl n { a n I n)e 2mnT , where ipE is the modular 
form of weight 2 and level N associated to E. The lattice A is generated by the real 
and imaginary periods, ^ which we denote by f2 re and f2i m . We assume that the 
Manin constant is 1, which is conjectured always to be the case for curves of positive 
rank (see [22| and US]). □ 



Theorem 2.8. — Let r = (3 x I e H^- Then T-'{4 > ( T )) has its coordinates in the 
Hilbert class field o/Q(-\/D)- Also we have 

1. (j)(/3 x I) = <f>(-0 x I- 1 ), m C/A. 

2. (j){W N {l3 x I)) = <j)(-j3 x In- 1 ) in C/A where n = [NZ + $±flz] , 

3. P(4>(P x /)) Artin (™) = -p{<f>(p x ^m- 1 )) for all m G CI{Q(VD)). 

Proof. — This is the theorem of complex multiplication of Shimura |22l 12 1| . We out- 
line the proof of the first statement, for which we work via the modular j-function. 
We have that j{r) is in the Hilbert class field H (see 1231 II, 4.3]) and similarly 
with j(Nr). Thus we get that Xq(N) over H contains the moduli point corresponding 
to the isogeny between curves with these j-invariants. Since the modular parametri- 
sation map <f> can be defined over the rationals, the image of the moduli point under 
d> has its coordinates in the Hilbert class field. □ 



Note that V(4>(t)) — V[4>(t)), so that there is no danger of confusing complex 
conjugation in C/A with complex conjugation of the coordinates of the point on E. 
Using the third fact of Theorem l2.8l we can take the trace of P(<^(t)) and get a point 
that has coordinates in Q(yZ)). Indeed, writing H for the Hilbert class field and K 
for the imaginary quadratic field Q(v^D) we get that 



. Artin(m) 

reGal(H/K) rneCl(K) 



P = Tmcc H/K (V(<f ) (T))) = V V{<I>{t))° = V V(<f>{/3xl)Y 



meCl(K) meCl(K) 

has coordinates in Q(-\AD). When E has odd functional equation, we can use the first 
two facts of Theorem 12.81 to show that P = P, so that P has coordinates in Q. In 
this case we have ipE — 4>e ° Wn which implies <fi = <fio Wn, so that in C/A we have 



(j>{(3 X m) = (/)(Wn(/3 x to)) = (j>(— j3 x mn^ 1 ) = x to 1 n), 
which gives us that 

p = v (<Kp x m )) = v { ( t ) {f 3 x m ~ ln )) = Yl v ( ( t ) (f 3 x m )) = R 

meCl(K) meCl(K) meCl(K) 



WOur convention is that the imaginary period is purely imaginary when the discriminant of E is 
positive, and in the negative discriminant case the real part of the imaginary period is O re /2. The 
fundamental volume f2 vo i is the area of the period parallelogram. 
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We can rewrite some of this by introducing some new notation. 

Definition 2.9. — We write Tt®({3) for subset of r € Tt® such that the associated 
form f r = (A, B, C) has B = (3 (mod 2N). We write H% = H%/T {N), and noting 
that T a (N) acts on H%(P), we write H%(P) = H%(f3)/T (N). 

Since Ti.^(0) is in 1-1 correspondence with CZ(Q(V r D)), we get that 

p = E v{wxm))= E pfaeo)- 

meCl(Q(VD)) reH°(l3) 



3. The Gross-Zagier theorem and an algorithm 

We now have a plan of how to find a non-torsion point on a curve of analytic 
rank 1 . We select an auxiliary negative fundamental discriminant D such that D is a 
square modulo AN, choose [3 £ SS(D,N), find r-representatives for H^(/3), compute 
4>(t) for each, sum these in C/A, map the resulting point to E via the Weierstrass 
parametrization, and try to recognize the result as a rational point. One problem 
is that we might get a torsion point. Another problem is that we won't necessarily 
get a generator, and thus the point might have inflated height, which would increase 
our requirements on real-number precision. The Gross-Zagier Theorem tells us what 
height to expect, and combined with the Birch-Swinnerton-Dyer Conjecture, we get 
a prediction of what height a generator should have. Our heights will be the "larger" 
ones, and are thus twice those chosen by some authors. 

Theorem 3.1. — Suppose D < —3 is a fundamental discriminant with D a square 
modulo AN and gcd(D,2N) = 1. Then 

HP) = ^L'(E,l)L(E D ,l) x 2 ^(D,N))(MDy\ 2 _ 
A\l vo \ \ I J 

Proof. — This is due to Gross and Zagier |15| . Here Ed is the quadratic twist of E 
by D, while w(D) is the number of units in Q(v A D) and u>(n) is the number of distinct 
prime factors of n. □ 

Calculations of Gross and Hayashi 16 indicate that this height formula is likely 
to be true for all negative fundamental discriminants D that are square mod AN. 

We now write P = IG+T where G is a generator^ and T is a torsion point, so that 
h(P) — l 2 h(G). Then we replace L'(E, 1) through use of the Birch-Swinnerton-Dyer 
conjecture [5] to get the following: ( 3 ) 



( 2 'Note that we will actually get y' #111 times a generator from our method, since we cannot disas- 
sociate III from the regulator in the Birch-Swinnerton-Dyer formula. 

(3) We use the convention that the Tamagawa number at infinity is equal to the number of connected 
components of E over R. — thus it is 1 for curves with negative discriminant and 2 for curves with 
positive discriminant. 
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Conjecture 3.2. — With notations as above we have that 

" = & (no ■ * m ) *mk L{E °- » ■ (^) 

In particular, we note that we should use a quadratic twist Er> that has rank zero, 
so that L(Eu, 1) does not vanish. The existence of such a twist is proven in [7]- Thus 
we have the following algorithm, which we shall work on improving. 

Algorithm 3.3. — Given a rational elliptic curve E of conductor N of analytic 
rank 1, find a non-torsion rational point. 

1. Compute L'(E, 1) and find a fundamental discriminant D < with D a square 
modulo 4N and L(Erj, 1) ^ 7 so that the index I is nonzero. 

2. Choose (3 G SS{D, N) and compute (to sufficient precision) the complex number 



oo 

a 



E E E 
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3. Let m be the gcd of I and the exponent of the torsion group of E. If the dis- 
criminant of E is positive, check if Viz) is close to a rational point on E for 
u = 1, . . . , Im for both 

z = (mRc(z) + u£l rc )/ml and i = (mRe(z) + ufl IC )/ml + f2; m /2. 

If the discriminant of E is negative, let o = Im(z)/Im(f2i m ) and check V(z) for 
z = (mRe(z) + uQ Te )/ml + oO re /2 over the same u-range. 

One can compute the index I in parallel with the 4>(t) , since both involve computing 
the a n of the elliptic curve E. However, this can cause problems if the index turns 
out to be zero (that is, if Ed has positive rank). 

3.1. Step 2 of the Algorithm. — We now discuss how to do the second step 
efficiently. First note that we can sometimes pair </>(r) with its complex conjugate; 
recalling that <fi = <fi o Wn, by Theorem 12. 81 in C/A we have 

(1) <t>{fi x T) = (f>(-[3 x r 1 ) = <j>(W N (-f3 x r 1 )) = 4>{(3 x {In)' 1 ). 

For / = (A,B,C) € we write f = (A/N,-B, CN), so that when g ~ / in the 
class group we have (/>(/) = <f){g) and thus </>(/) + <j)(g) — 2 Re </>(/) in C/A. We refer 
to this as pairing the forms. 

For ^2 n {an/n-)e 2nmT to converge rapidly, we wish for the imaginary parts of our 
representative r's to be large. It turns out the best we can do is essentially have 
the smallest imaginary part be about 1 /N in size. We can achieve this via a trick of 
Delaunay, which introduces more Atkin-Lehner involutions. 

Definition 3-4- — Let Q\N with gcd(Q, N/Q) = 1, and let u, v £ Z be such that 
uQ 2 - vN = Q. The Atkin-Lehner involution Wq sends r to 
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This defines Wq up to transformations by elements in Tq(N). One can check that 
Wq(Wq(t)) is in the To (iV)-orbit of r, and that the Wq form an elementary abelian 
2-group W of order 2 W ( N '. The important fact about the Wq's that we shall use is 
that tpE = ±ipE ° Wq, so that </>(r) = ±</>(Wq(t)) + 0(Wq(zoo)). The sign can be 
computed as 6q — Y[ p \q e p where e p is the local root number of E at p. Delaunay's 
idea is to maximise the imaginary part of r over Tq(N) and W rather than just Tq(N); 
the difficulty is that the action of Wq need not preserve (3. However, we still have 
that 

P= ^( T )= £ tQ<t>{W Q (T)) + (torsion point). 

For the analogue of the second part of Theorem l2.8l we need to consider what happens 
with to [3. We define (3q as follows. We make (3q and (3 have opposite signs mod p k 
for prime powers p k with p k \\Q and gcd(p, D) — 1, and else (3 = (5q. In particular, we 
have that Q = gcd(/3 — /3q, N) when N is odd. The desired analogue is now that 



0(Wg(/3x 0) -£q0(/3q x ? g - 1 ) + 0(M/ Q (ioo)) with g 



The primes p which divide I? are different since there is only one square root of D 
mod p; thus (3 is preserved upon application of Wq for Q that are products of such 
primes. For such Q, we can note the following with respect to complex conjugation. 
Suppose we have that m ~ {In) -1 so that by JIJ we have 4>((3 X I) = cf>(f3 x m). Then, 
using the fact that q^ 1 = q in this case, in C/A we have, up to torsion, that 



4>{W Q {P x 0) = £q<M/3q x Zg-i) = e Q 4>{P Q X (Ig" 1 ^- 1 ) = £ q0(/3q X (Zgn)- 1 ) = 

= 0(Wq(/3 x {In)- 1 )) - <KPW x m ))- 

So we see that {j3 x Z) can be paired iff Wq(/3 x i) can be paired. 

We now give the algorithm for finding good r-representatives. The idea to run over 
all forms (aN, b, c) of discriminant D with a small, mapping these via the appropriate 
Atkin-Lehner involution(s) to forms with fixed square root /3, and doing this until the 
images cover the class group. Of course, the conjugation action is also considered. 

Subalgorithm 3.5. — Given D,N, find good r-representatives. 

1. Choose 13 G SS(D, N). SetU = and R = %. 

2. While #R ± #CI((QVD)) do: 

3. Loop over a from 1 to infinity and b £ SS(D, N) [lift b from Z/2N to Z/: 

4. Loop over all solutions s of Ns 2 + bs + (b 2 — D)/4N = modulo a: 

5. Let f = (aN, b + 2Ns, ((6 + 2Ns) 2 - D)/AaN) . 

6. Loop over all positive divisors d o/gcd(D, N) [which is squarefree]: 

7. Let g — Wq(/)/Q where Q is d times the product of the p k \\N 

with b ^ j3 mod p k , so that g G ri^(j3). 

8. If the reductions of g and g are both not in R then append them 

to R, and append f to U with weight £q when g ~ g and with 
weight 2cq when g ^ g. 
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With this subalgorithm, we get that z = J^feu we ight (/)</> (17) in Step 2 of the 
main algorithm. We expect the maximal a to be of size #CZ(Q(v r D))/2#W / . This sub- 
algorithm makes "parameter selection" fast compared to the computation of the 4>{t). 

3.2. Step 3 of the Algorithm. — We now turn to the last step of our main algo- 
rithm, reconstructing a rational point on an elliptic curve from a real approximation. 
The most naive method for this is simply to try to recognise the as-coordinate as a ra- 
tional number. If our height calculation tells us to expect a point whose as-coordinate 
has a numerator and denominator of about H digits, the use of continued fractions 
will recognise it if we do all computations to about twice the precision, or 2H digits. 
We can note that by using a degree- n map to P™ -1 and n-dimensional lattice reduc- 
tion, this can be reduced to nH/(n — 1) digits for every n > 3 — we will discuss a 
similar idea later when we consider combining descent with our Heegner point com- 
putations. But in this case we can do better; we are able to recognise our rational 
point with only H digits of precision due to a trick of Cremona, coming from an idea 
in a paper of Silverman |24| . The idea is that we know the canonical height of our 
desired point, and this height decomposes into local heights; we have 

h{P) = hooiP) + h p( p ) + lo S denominator (as (P)). 

p\N 

The height at infinity (P) can be approximated from a real-number approximation 
to P, and there are finitely many possibilities for each local height h p (P) depending 
the reduction type of E at p. We compute the various local heights to H digits 
of precision, and then can determine the denominator of as(P) from this, our task 
being eased from the fact that it is square. Then from our real-approximation^ 4 ) 
of P we can recover the as-coordinate, and from this we get P. Note that we need to 
compute L'(E, 1) to a precision of H digits, but this takes only about \/]V(log H)°^ 
time. In practise, there can be many choices for the sums of local heights, and if 
additionally the index is large, then this step can be quite time-consuming. This can 
be curtailed a bit by doing the calculations for the square root of the denominator of 
the as-coordinate to only about H/2 digits, and then not bothering with the elliptic 
exponential step unless the result is sufficiently close to an integer. 

3.3. Example. — We now give a complete example. Other explicit descriptions of 
computations with Heegner points appear in [2J 1261 117) . We take the curve given 
by [1,-1,0,-751055859,-7922219731979] for which the Heegner point has height 
139.1747+. We select D = —932, for which the class number is 12 and the index 
I is 4. We have N = 11682 and choose (3 = 214. Our first form is (11682,214,1) 
to which we apply W\ — id. The reduction of this is (1,0,233), and it pairs with 



( 4 'Elkies tells us that, given the height to precision H, the techniques of 1141 (see Theorem 4 in 
particular) can reduce the needed precision of the real Heegner approximation to o(H) as H — > 00. 
The idea is that for a fixed C the equation heo((x,y,z)) +21ogz = C defines a transcendental arc, 
and thus the use of a sufficiently high degree Veronese embedding will reduce the needed precision 
substantially. This method in its entirety might not be that practical, though the use of height 
information in conjunction with the geometry of the curve should allow a useful reduction in precision. 
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itself under complex conjugation. Since we have gcd(£>, N) — 2, we can use W2 
without changing /3; we get the form (206717861394, 70769770, 6057) which reduces 
to the self-paired form (2,2,117). Our next form is (11682,2338,117) to which we 
apply Wn to get (122225810454,230158978,108351) which reduces to (11,6,22) and 
pairs with (11, —6, 22). Applying W22 gives a form which reduces to (11, —6, 22), so we 
ignore it. Next we have (11682, 2810, 169) to which we apply Wg, getting a form that 
reduces to (9, 2, 26) and pairs with (9, —2, 26). Applying Wis gives a form that reduces 
to (13, -2, 18) and pairs with (13, 2, 18). Then we have (11682, 4934, 521) to which we 
apply Wgg, getting a form that reduces to (3,-2,78) and pairs with (3,2,78). And 
finally applying Wigs we get a form that reduces to (6, —2, 39) and pairs with (6, 2, 39), 
and so we have all of our r-representatives. We note that Wn, Wg, and Wis switch 
the sign of the modular form, and thus the obtained forms get a weighting of —2. 
The self-paired forms get a weighting of +1, and the other two forms get a weighting 
of +2. For the non-self-paired forms we must remember to take the real part of 
the computed <P(t) when we double it.' 5 ' The pairing turns is rather simple in this 
example, but need not be so perspicacious with respect to the class group. Note that 
we use only four distinct forms for our computations. 

We need about 60 digits of precision if we use the Cremona-Silverman method to 
reconstruct the rational point, which means we must compute about 20000 terms of 
the L-series. The curve E has negative discriminant and no rational torsion points. 
We compute a real-approximation to the Heegner point in C /A to be 

z = 0.00680702983101357730368201485198918786991251635619740952608094. 

We have o = Im(z)/Im(Sli m ) = 0, and with I = 4 and u = 2 we get that 

i = 0.00891152819280235244790996808333469812474933020620405901507952, 

to which we apply the Cremona-Silverman method of recovery. The curve E is an- 
noying for this method, in that we have many possibilities for h p {P). The height of 
the Heegner point is given by 

h(P) = 139.174739524758127811521877478222781093487974225206369462318, 

and the height at infinity' 6 ) is given by 

hoo{P) = 2.10306651755149369196435189022120441716979687181328497567075. 

The reduction type at 2 is I25 , at 3 it is I* 3 , at 11 it is I\, and at 59 it is I3. Thus 
we have 13 x 3 x 1 x 2 choices for the local heights. It turns out that we have' 7 -* 
hp(P) — ^Vp(A) logp for p = 2, 11, 59, while h 3 (P) = (13/6) log3. The denominator 
of the x-coordinate is 12337088946900997614694947283 2 , and the numerator is 

5908330434812036124963415912002702659341205917464938175508715. 



( 5 ) The self-paired forms / have <j>(f) = <f>(f) in C/A but not necessarily in C — the imaginary part 
cannot be ignored when the discriminant of E is negative and Ira is odd. 

( 6 ) Note that Silverman 1241 uses a different normalisation of height, and his choice of the parameter 2 
when he computes the height at infinity corresponds to z/n re for us. Also, his method is only linearly 
convergent, while that given in [5] §7.5.7] is quadratically convergent. 

' 7 )This follows a posterori since P is nonsingular modulo these primes of multiplicative reduction. 
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3.4. Variants. — Next we mention a variant which, for the congruent number 
curve, has been investigated in depth by Elkies |13j . Here we fix a rank zero curve, 
say the curve E : y 2 = x 3 — x of conductor 32, and try to find points on rank 1 
quadratic twists Ed with D < 0. It can be shown that Ed will have odd functional 
equation for \D\ = 5,6,7 (mod 8). There is not necessarily a Gross-Zagier theorem in 
all these cases, and some involve mock Heegner points instead of Heegner points. How- 
ever, we still have the prediction that h(P) = chdL(E, 1)L'(Ed, 1) for some cud > 0. 
Elkies computes a point P in C/A via a method similar to the above — however, he 
generally^ 8 ) only attempts to determine if it is non-torsion, and thus need not worry 
as much about precision. There are about #Cl(Q{VD)) « y/\D\ conjugates of r 
for which 4>{t) needs to be computed; since we have an action of To (32), computing 
each 4>{t) takes essentially constant time, so we get an algorithm that takes about 
time l-DI 1 / 2 to determine whether the computed point is non-torsion. Note that we 
don't obtain L'(Ed,1), which takes about \D\ time to compute, but only whether 
it is nonzero. MacLeod |18| investigated a similar family of quadratic twists, those 
of a curve of conductor 128. The relevant curves are y 2 — (x + p)(x 2 + p 2 ) with 
p = 7 (mod 8); with p = 3167 the height is 1022.64+. Some additional papers that 
deal with the theory and constructions in this case are those of Birch and Monsky 



4. Combination with descent 

To find Heegner points of large height, say 500 or more, it is usually best first to 
do a descent on the elliptic curve, as this will tend to reduce the size of the rational 
point by a significant factor. ( 9 ) Upon doing a 2-descent, we need only H/3 digits 
of precision if we represent the covering curve as an intersection of quadrics in P 3 
and use 4-dimensional lattice reduction, and if we do a 4-descent we need only H/12 
digits. We first explain how these lattice reduction methods work, and then show 
how to use them in our application. It might also be prudent to point out that if E 
has nontrivial rational isogenies, then one should work with the isogenous curve for 
which the height of the generator will be the smallest/ 10 ) 

4.1. Lattice Reduction. — Most of the theory here is due to Elkies |14| . We 
first describe a p-adic method — this is not immediately relevant to us as we do 
not know how to approximate the Heegner point in such a manner, but it helps to 
understand the idea. Let F(W, X, Y) — be a curve in P 2 . We wish to find rational 
points on F. Let (1 : x s : y s ) be a (nonsingular) point modulo some prime p, and 
lift this to a solution (1 : %o '■ Vo) modulo p 2 . Then determine d such that any linear 
combination of (1 : xq : yo) and (0 : p : dp) will be a solution mod p 2 (computing d 



( 8 )Elkies also computes a generator of height 239.6+ for y 2 = x 3 — 1063 2 x in this manner. 
''^During the mid 1990s, Cremona and Siksek worked out a few examples using 2-descent. 

Because III might have different size for the various isogenous curves, we cannot always tell 
beforehand which curve(s) will have a generator of smallest height. 
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essentially involves taking a derivative). Then perform lattice reduction on the rows 
of the matrix 

'1 ^o 2/0 N 
p dp 
v p 2 

Finally search for global solutions to F by taking small linear combinations of the rows 
of the lattice-reduced matrix. If we choose p to be around B for some height bound B, 
upon looping through all local solutions modulo p we should find all global points 
whose coordinates are of size B; in general we take p of size B 2 l n in projective n-space. 
This can be used, for instance, to search for points on a cubic model of an elliptic 
curve. ( n ) 

Over the real numbers the description is more complicated. Here we deal with 
the transformation matrix of the lattice reduction. If we wanted to do 2-dimensional 
reduction, that is, continued fractions, on a real number xq, we would perform lattice 
reduction on the rows of the matrix 

,0 B ) 



M 2 = 



(I 


-x Q B (y'x - y )B 2 
B y'B 2 


(-e(y'x - yo) + z'x - z )B 3 \ 





(ey' - z')B 3 





B 2 


-eB 3 







B 3 J 



to get good rational approximations to xq. We can note that (l,Xo)M2 — (1,0) and 
that the transformation matrix T for which TM% is lattice-reduced has the property 
that (1,0)T is approximately proportional to (\,Xo)- In four dimensions we take a 
point (1 : xq : yo : zq) on some curve, assuming that derivatives of y and z with 
respect to x are defined at this point. The matrix we use here is*- 12 ) 



Ma 



Here e = z" jy" and all the derivatives are with respect to x and are to be evaluated 
at (1 : xq : yo : zq). Note that if we have computed (1 : xq : yo : Zo) to H digits of pre- 
cision, we must "lift" it to precision 3H to use this. Similar to the 2-dimensional case 
> > > 

of above we have that (1, Xo, yo, zo)Mi = (1, 0, 0, 0), and (1, 0, 0, 0)T is approximately 

■ > 

proportional to (1, Xq, yo, Zq). 

4.2. Results. — We now combine descent with the Heegner point method. We 
assume that we have a cover C — * E, and for each point V(z) given by the above algo- 
rithm we compute its real pre-images on C. For a 2-covering quartic, the x-coordinate 
has size H/4, but the y-coordinate on the quartic will be of size H/2. Either continued 
fractions on the x-coordinate or 3-dimensional lattice reduction on both coordinates 
and the curve requires a precision of H/2 digits — however, if our 2-cover is given 
as an intersection of quadrics in P 3 , then we only need a precision of (H/2)(2/3) 
since the Elkies method does better in higher dimension. For a 4-cover represented 



(H)This description is due to Elkies and is noted by Womack ( 1301 Section 2.9]). 
( 12 )Xhe 3-dimensional version is just the upper-left corner. 
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as an intersection of quadrics in P 3 , the coordinates are of size H/8, and so we need 
a precision of (i?/8)(2/3) to recover our point. 

We now give two examples of Heegner points of large height/ 13 -' First we consider 
E given by [0, 1, 1, -4912150272, -132513750628709], for which N = 421859. Here 
the Heegner point is of height 3239. 048+. We refer the reader to |30) for how to 
do a 4-descent. The intersection of quadrics that gives the 4-cover is given by the 
symmetric matrices 



/l 

3 
14 
4 



14 

9 



4 \ 



and 



/ 16 


-10 


5 -5\ 


-10 


29 


-3 -5 


5 


-3 


-1 8 


V-5 


-5 


8 13/ 



The class group has size 4; upon 



-8 19 
19 13/ 

We used D = —795 for which the index is 4. 
using the pairing from complex conjugation we need only 2 forms, which we can 
take to be (421859,234525,32595) and (421859,384997,87839). We need to use 
about 3239/12 log(10) « 120 digits of precision and take around 1.3 million terms 
of the L-series. For our approximation to a generator on C /A we get 

Z = 0.0082583151S406S143124509S564622255S391095207954623175715662S971276351260065606268919149831305742123430007S0426018430276055. 

We find the real pre-images of this on the 4-cover (this can be done via a resultant 
computation) and then via 4-dimensional lattice reduction we obtain the point 

(9058584922235062101 13393024249323265421424744748843313130312 1633820405 38806 7007794470 130249 185257282373 12026342662 1 44441 46702504489824552529044887487947854472355 124439471295729. 
582078484694685672492501009047456045 1 744 1 58462 1654 1 (U 06564953768944605644 1 3 1 80680 1 9646 159331 652586264579879746727045454745 1 7 1 075(108 1 3467 1 3499645 1 3424870607 I5734078532766IO7 1 757, 
-526601 8347300483 18750844 1 06429 1 82505324580075229565235 1 5279464248 1747302402870 1 8424 14870 1587 1 2300026922 1530600465998289 1 1 24434459579453775304 1 254094 1 20245956874365641 128 176688 1, 
12056634395599472444326816265 10637502861594249 1547240259546994439702482 I 83552 1392662 1 5645747927 8825658673 2898758 8 1 6466 15 629 1 2 84505 97657404394604 1 0258 1 49 1 7990755893 2675 1 709650806). 

which can then be mapped back to E. Even though we only used 120 digits of precision 
in our computation of a real approximation to the Heegner point, we can recover a 
point with approximately 3/2 as many digits. Note that if we did not use descent, 
but recovered the point on the original curve using the Cremona-Silverman method, 
we would need 12 times the precision and 12 times as many terms in the L-series — 
this could be a total time factor of as much as 12 3 , depending upon the efficiency of 
our high-precision arithmetic. This computation (including 2-descent and 4-descent 
which each take a second) takes less than a minute. 

Finally we give a more extreme example — this is the largest example which we 
have computed. The curve is from the database of Stein and Watkins 1251 . Let E be 
given by [0, 0, 1, -5115523309, -140826120488927], for which N = 66157667 and the 
Heegner point is of height 12557+. The intersection of quadrics that gives the 4-cover 
is given by the two symmetric matrices 



and 



We select D = -1435 for which our 2 forms are (66157667,2599591,25537) and 
(66157667, 37610323, 5345323) and the index is 2. We need 460 digits of precision and 



1 


3 3 \ 


1 5 


-1 -6 


3 -1 


8 -2 


\3 -6 


-2 16 J 



( 12 


-21 


-10 


-68\ 


-21 


-13 


-7 


-27 


-10 


-7 


3 


-7 


\-68 


-27 


-7 


15 J 



(13) These examples exemplify the experimental and heuristic correlation between large heights and 
large cancellation in c| — c§ = 1728 A, sillCG Ore can then be unusually small for a given | A | . 
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600 million terms of the L-series. This takes less than a day. We list the x-coordinate 
of the point on the original elliptic curve. It has numerator 



367770537 1866775(166 1-00564254 1 K27 1 700* 
7273933*0262*1573250924797082687602171' 
07*523* 1696**52276500720599644* 15972 1 5- 
370337701056 1 6573500*5')()64029709029K70' 
41097*2746*479512*57941 1929*941 2 144907' 
5514929232555*5*9*5 197973702640271 1049 
339847275422440094555*247051X922565367 
01649986417295226774(105259994990779421 
909.:*6476566652* 1 596 I 7S 145722 1 1 609*2 1 6 
867739443749*- 1 *094567 1 5**41 9372032890 
44498220455*6092 1 224991)969785448 172 188 
8 17 1538534400 1 979*52252652414888335865 
2574798740K94035649650.:***5379S 17*6692' 
**24247X005942 70*620520*2 I *5 975 393 2900' 



;x.: l | )ii:2"S( 1 ( 1 3-\S')25 -": I i)5') 155555!' 
029649347049289 1 19 1 88596869401 159: 
974991190741697350414232211175705: 
7 1 2483 1 69437963732 17191 9939969937 
793126656928657859036779350593274. 
59899757 1 6259259240 1 52X5405094065- 
209859765703930378802827649670195: 
1269729319041016852811289447800741 
6268574593 123245 10742034KX7K 101 76. 



0762241 IOX7X0937IX721572IO- 
M) 1 65442425 I 359564606*76*2( 
7937*93X41 *X*0 142666X5 1776 1 
*9992X995X255459765210X509( 
1 635437 14996249652420 1 7 1 1 7 1 
2466204707 1 25X I 1 665625662X.- 
425X9 I 2 5 45 42 6X5X05 9 7- *-5 7 1 1 
035 1 7 1 1 307496637235-767593' 



13649: 



v-;5Sc>')7 



250X*243240736795*4i: 



29686294*06! 75*759'i2*65 1 7c : 
10)251**7251 1624*9*5176156 
*59595MKK! I55K93055 10201 N 
93550560531141130156032119 
245637257-4495639792 1 57S24 
740-**'l696*05 75-14660029755 
20836045916631548489195 



1762X171- 
: *9--42 I 



7-61-6: 



:6-7-9( 



194 



:5- i9o< 



2694308617337435444029085K649730535.;6O9999-3 12 1 -^332()252252S7 171 092 144929: 
L o66957**55529-i5*7 199454 1770*5**719505-1222050777167149*46651*10*722622109- 

100655* 1 270 I 590*52499052 I 25722304 1 7942249795467 I 907903939-143 I 0325999677 I 79 I *2 I 09970945546*07.: 350 14446*5 
299449340025^965 0929X935 93935772 1723543933 10*7432419975*74470 1 *595')25520 16765764052*407957069*454395013 
SI2346i)5S674i5 ( )i l Ui)2ii:672-6264i!liS55.;6 | i63652l :55(iii'): -7 : 762-5 'J 9- 1-''0(V)2 2. 5 45*6-69 2*5-90 7 2 55 7 65.: .54* 70495 190 1 7 64*4745 9 7 7245 2025 2 756- *9 646* : 5*72 I O254O7O*-9.:06.:5O 1 ') 1 
79038O412396I 15446240*525*54* 1566572 1 5250O*-i9O60*55262 156*525 1531 1 05 2 903 3 67 5 03 S 5 743 79205 0S93 1 3 05 2 S3 14337942393069 1 369 1 54.5.7255067727**6206665***425022179164712 
3563 !-i2!-i9564625 399X3567929-9949334662297749490359 I 722345 I **97506294 I '107-1 ; 5 40(1740881 



and denominator (which is square) 



2592K77*55975*5*96(ih7s| l5 7 7*6957 7 O5940490529- 
* 15397652*054**57*7579*90 1 74**25245465 *04440- 
1 57406 1 954766-15*35666 1 270643*06-220965954420: 
323*96030 I 53**4622671 9 I 5*65 14299244523629967 
7001205209064*57557600160942225772*323075912: 
256*619557**54 1952754 14555*006*20535219145301 
6449079490990530*255944977729321377913661 153.' 
1*7902550*99716-0*2659 1421*65446416159176555. 
K06 1 242 1 6*26476 1 9 1 5*27597 1 2062 1 69 1 10751021 I0( 
101*5696905019214515170157956522244*59592956 



>97*520669-1*9250')4*9I59*-53'I247'I060050*65239526960545: 
14704047 1997552533*276950722 1039*747506 143*70*500**4 
!58828268844376 147020*660107291 24602050467 189871 119197 
1555 6 1 55907460O46*6*07506554575::4297972*257 1 4265959*01 
1165 749*2910152024452061774*322191502167*256255579*954 
; 0624*622* I 49O47*2275476509064*26525609-055-*25 5605225 



77009 



>**l*65l 1 62455(1- 5*254*725555 19- I 1256201 1 50575 1 25255*-24--0 1-6*0*2-67. ; 2')')**2 15525522'. 1 '. 1 1 72 1 679'. | 7565726 121*5555210 
10400! 1 64*1 0277*922** 105257250-1 76250*056*-25427769667* 1 577 1 9267749527425*946*2541440235747596742 1*59971 7724794 
il84513570505904 1 770761 7730025552047 145505 1572*51 *0422755 1 5609556*5976 1 902 1 5 40*007425'.'* 749 5 64*99 16483283558415 
'43155015266875565 1 02*7*6525*2253-11*.; 1 409297024-0-55')4*79*622547006 1 42*599*529 1 01 1 99562* 1 * I 555724O6503736123O3 
!2250292 10397375*2*07*654552 1293000346 1 1 755593010* 145915 11*1 54377991 059255962745297*6301 703541452242**25*324* I 
1352935567534*96297 1 4**95 1 1 *420*5 1 960225**54025 1 555005*1 1757426015292*63152291957*9791*4*640470464974617150056 
622597482005079*241*7040000541*95*5 l.;0(,7 l)( , | :s ii')')502*927954 1 945230*41 I 1 76961 7776*5 1 695937*94-i(U454045*676.5622 1 60449971 09-1*7727459226 1 *2014355904 1089932670055 
51298147417*156** 14174760051 5791 795741 *.;7O5665646076025')O*-2*64 1-50-0 1 69 1 692*65. ^5755757-1955 1 675 I 5**7569755567*O7556*4-546250O5'i7 : 249'i9569 l2*76*5-*2')06'4-70 1 5 : 
5969575*671*4554505.: 15069252-956)905) I 1 *6650 12 I 760')* I 7*2607*-0 1 6*99909*92*25429-i7669O65')575-i()9055 1 5265457***21 2 I 1 075*700 1 6226*046**5 I Oi 2*26 1 56445 7467501381 181 
998954522996275-19452761944*71 I 1 2597 1 *2275542* 1 25 1 75 1 692*555071 *5547549647947 1 1 774745**594-6909459927*566501 1 505272 1 9929702*5594* 1 *657 1 102*7 101 947*295556041049 
945697905300902 I. M6 1 267052*0 1 44207697*425**4.U057*2906*4944705665*42205*7.U:U946*955 

06569509*29555522 1551 42406*9644 1 472229*7920 1 2505072-7 ;.:5O.:025.: 7504 1-9 1 926*0*61-2* I 519 1 1*1 I 556 1 5 1 02 065 4502 7. ; * 7.1 ; 7*955 3')(i05 605 562*7 I 722565 16-65975-529952 1 97 1 795 
72083803798469762*4134501*74*9750410679547055**99054*25624*4947256517590452*952 1**271029*95020102654.5472967707*120577550.59495444795255020594607206147343184720 
12891382027947113716*45979529657679391 12 I 796342422 1 95*0**255275 I '159067*25646242 1 4705 1 55*06 1 022570**025259 1 I 1 66 1 25 1 1 655*07*055-14* 1 07565 I 17561 12015725788207983 
04346277884275554*5656242565-7677! 1 06266-150555*97646-14475.5.9505** 1 6499 142609*055 565 ] 2554550*0*704 1 15-17161 166201727521046199497575515*052916*97*62-12134493722493 
6540132813720* 1 90*79605 *47')4*65 1 52750525579241 209*0*5*994 1 7962 1 *972752 I 75245666 60-0*52525 I '.'66 1 4** I 1**50*75265706592265572 I 727***5***6 :o06697O67295082662856621 
4278955509812709*507594755*2274095***60*04*526*977*7509*57569-1622* 1556 1 2* 1 7695*4*5275977425400522 167595655*256702*77699726*9262254242465*164907**24*4814569895 
7**20*4 1 3 2643 79 02 5 070 74*25 5* 729 729*22 722*464 55 2 95 2 55 6 5-*4 1 52-505 1 2*04 1 -97093455 -* 1 5005565*5*5665*6 l*6O')09 I -2-- 1 2-4 1 502-7526 1 '.'262 ! 709 1 116:6050207.5 IO* l')57204')-2 
1637232671248907772597 1 6245*9555 1 *750 1 66-1652745255 1 91 95925966950757*6057 1 076*5*702566 1 969449544902*7975 1 1 7**06**95*6055 *-!70-46622507.5.**-5*.5.662624420537 1560027 
873450866832479574095i)()*0l 1 5 I 49044.5.5539494729790*9*2 I 1 9*999392592205* I 20 I I 7*6324 1 9655540957-1966*627907690962*7 1 0.5922007091 9266*7 147 1 * 1 74 1256557543028535996580 
459474552765 1 569**60755*7 1 94295961 5 1 1 1)56 1 7*50655*0776*57 1 972 2 00-9 7 2 02 05 45 66465 2 0575*097*09405*49526*-*7752662594679 1 29-27-5545*02559 1 450 1 5600-1*50903 1 82 1084423 
72425264218315757261*57*0765*1*5*61 1 Oil 19*405* 1 512*1 7*5675655*69920565-792269455 *49*65956277 I 79*04 1 6 1 *(U60 1 5662255*7* 1 9 1 246 1 75024597577*6 1 *25966407677879013966 
44*260555004 15524947 1*524 1*5255-62 1 5677) 50) *50'i7 I I O*')O')'i*'i65')075*9 I 1615 : 2 NS2'J64 h4f-.NS7544 i K, J (i47S'J( I 52 I(i5 10227 1 52H I i:4. )( )547f-.5i()7552 15S20I 575 : 'J')S26I 5256-^5 ]5(-.5'^(i5 
086773102059455947746691 5-1*5*5452090*20*4 !5.5<)*65954456575*9 1 2591O770359979I 1 074 2764752*7555245* 1 47*022*66250*565*506555525957*293791449*29257495 1 0228726599819 
6-1925226*50-1*5 1*70*5-) 0057527 1 7* 1262*52567 1 2 1965.:05.:*50557'4 1 1 9-740*6 1 *5706-*0* 1 0-4 1 1 '15 I l*5*O')2')667*')9*5**05.5*6 1 **.:*7-'i75(4(o95572 5959056 1 'I52'i2*55759*24 1 97002 
85747 1663*7929*56* 1*64521*64*07*765 16552795271 72759403662 1755592160501** 101 7549()42667*52()995595'i2 I ')57402*07*-2 ) 1 5O*-**560 1 77 )4'i977 15*55 1 56 1 6)-*5**41925765254 1 
10965702365*00067*477*2401 155042 150*5 1 55475 1 145566545520555097 1 25 7505407650064* 0*-29O5*26240579656224 1 1*5445271276676455574274174*25717641*6299386690494751101 
458314876295 1***762275247975 1 575475257265 720522099995O2 I. ;5i); 7 .;526902203987716. 
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